GHSA-g2fm-8hr4-j82hhigh8.1

EasyAdmin custom-action dispatcher bypasses access_control on other routes

The advisory, in context

Summary

EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() / MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event.

That swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user could reach a more restricted route by name.

Impact

Any application where access_control (or another path-based Symfony security rule) protects some routes more strictly than the dashboard URL used to reach EasyAdmin. An attacker who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule.

Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] / denyAccessUnlessGranted() remain protected, because those checks are recomputed against the swapped-in controller.

Patches

Fixed in 4.29.16 and 5.5.1. Before dispatching a custom-action route, EasyAdmin now re-evaluates the target route's access_control rule and denies the request if the current user is not granted access.

Workarounds

Add controller-level authorization (#[IsGranted] / denyAccessUnlessGranted()) to any sensitive route, since controller-level checks are still enforced. Upgrading is the recommended fix.

Credits

Reported by @TungNGo02.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

easycorp/easyadmin-bundle Packagist

Ecosystem versions

From 4.0.0 before 4.29.16

Fixed in 4.29.16

162 explicitly affected versions

v4.0.0, v4.0.1, v4.0.10, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.1, v4.1.2, v4.10.0, v4.10.1, v4.10.2, v4.10.3, v4.10.4, v4.10.5, v4.11.0, v4.11.1, v4.12.0, v4.13.0, v4.13.1, v4.13.2, v4.13.3, v4.13.4, v4.13.5, v4.13.6, v4.14.0, v4.14.1, v4.14.2, v4.14.3, v4.14.4, v4.14.5, v4.15.0, v4.15.1, v4.16.0, v4.16.1, v4.16.2, v4.17.0, v4.18.0, v4.19.0, v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.20.0, v4.20.1, v4.20.2, v4.20.3, v4.20.4, v4.20.5, v4.20.6, v4.20.7, v4.20.8, v4.21.0, v4.21.1, v4.22.0, v4.22.1, v4.22.2, v4.23.0, v4.23.1, v4.23.2, v4.23.3, v4.24.0, v4.24.1, v4.24.2, v4.24.3, v4.24.4, v4.24.5, v4.24.6, v4.24.7, v4.24.8, v4.24.9, v4.25.0, v4.25.1, v4.26.0, v4.26.1, v4.26.2, v4.26.3, v4.26.4, v4.26.5, v4.27.0, v4.27.1, v4.27.2, v4.27.3, v4.27.4, v4.27.5, v4.27.6, v4.27.7, v4.27.8, v4.28.0, v4.28.1, v4.29.0, v4.29.1, v4.29.10, v4.29.11, v4.29.12, v4.29.13, v4.29.14, v4.29.15, v4.29.2, v4.29.3, v4.29.4, v4.29.5, v4.29.6, v4.29.7, v4.29.8, v4.29.9, v4.3.0, v4.3.1, v4.3.2, v4.3.3, v4.3.4, v4.3.5, v4.4.0, v4.4.1, v4.4.2, v4.4.3, v4.4.4, v4.4.5, v4.5.0, v4.5.1, v4.5.2, v4.6.0, v4.6.1, v4.6.2, v4.6.3, v4.6.4, v4.6.5, v4.6.6, v4.7.0, v4.7.1, v4.7.2, v4.7.3, v4.7.4, v4.7.5, v4.7.6, v4.7.7, v4.8.0, v4.8.1, v4.8.10, v4.8.11, v4.8.12, v4.8.13, v4.8.2, v4.8.3, v4.8.4, v4.8.5, v4.8.6, v4.8.7, v4.8.8, v4.8.9, v4.9.0, v4.9.1, v4.9.2, v4.9.3, v4.9.4, v4.9.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "fixed": "4.29.16"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v4.0.0",
    "v4.0.1",
    "v4.0.10",
    "v4.0.2",
    "v4.0.3",
    "v4.0.4",
    "v4.0.5",
    "v4.0.6",
    "v4.0.7",
    "v4.0.8",
    "v4.0.9",
    "v4.1.0",
    "v4.1.1",
    "v4.1.2",
    "v4.10.0",
    "v4.10.1",
    "v4.10.2",
    "v4.10.3",
    "v4.10.4",
    "v4.10.5",
    "v4.11.0",
    "v4.11.1",
    "v4.12.0",
    "v4.13.0",
    "v4.13.1",
    "v4.13.2",
    "v4.13.3",
    "v4.13.4",
    "v4.13.5",
    "v4.13.6",
    "v4.14.0",
    "v4.14.1",
    "v4.14.2",
    "v4.14.3",
    "v4.14.4",
    "v4.14.5",
    "v4.15.0",
    "v4.15.1",
    "v4.16.0",
    "v4.16.1",
    "v4.16.2",
    "v4.17.0",
    "v4.18.0",
    "v4.19.0",
    "v4.2.0",
    "v4.2.1",
    "v4.2.2",
    "v4.2.3",
    "v4.2.4",
    "v4.20.0",
    "v4.20.1",
    "v4.20.2",
    "v4.20.3",
    "v4.20.4",
    "v4.20.5",
    "v4.20.6",
    "v4.20.7",
    "v4.20.8",
    "v4.21.0",
    "v4.21.1",
    "v4.22.0",
    "v4.22.1",
    "v4.22.2",
    "v4.23.0",
    "v4.23.1",
    "v4.23.2",
    "v4.23.3",
    "v4.24.0",
    "v4.24.1",
    "v4.24.2",
    "v4.24.3",
    "v4.24.4",
    "v4.24.5",
    "v4.24.6",
    "v4.24.7",
    "v4.24.8",
    "v4.24.9",
    "v4.25.0",
    "v4.25.1",
    "v4.26.0",
    "v4.26.1",
    "v4.26.2",
    "v4.26.3",
    "v4.26.4",
    "v4.26.5",
    "v4.27.0",
    "v4.27.1",
    "v4.27.2",
    "v4.27.3",
    "v4.27.4",
    "v4.27.5",
    "v4.27.6",
    "v4.27.7",
    "v4.27.8",
    "v4.28.0",
    "v4.28.1",
    "v4.29.0",
    "v4.29.1",
    "v4.29.10",
    "v4.29.11",
    "v4.29.12",
    "v4.29.13",
    "v4.29.14",
    "v4.29.15",
    "v4.29.2",
    "v4.29.3",
    "v4.29.4",
    "v4.29.5",
    "v4.29.6",
    "v4.29.7",
    "v4.29.8",
    "v4.29.9",
    "v4.3.0",
    "v4.3.1",
    "v4.3.2",
    "v4.3.3",
    "v4.3.4",
    "v4.3.5",
    "v4.4.0",
    "v4.4.1",
    "v4.4.2",
    "v4.4.3",
    "v4.4.4",
    "v4.4.5",
    "v4.5.0",
    "v4.5.1",
    "v4.5.2",
    "v4.6.0",
    "v4.6.1",
    "v4.6.2",
    "v4.6.3",
    "v4.6.4",
    "v4.6.5",
    "v4.6.6",
    "v4.7.0",
    "v4.7.1",
    "v4.7.2",
    "v4.7.3",
    "v4.7.4",
    "v4.7.5",
    "v4.7.6",
    "v4.7.7",
    "v4.8.0",
    "v4.8.1",
    "v4.8.10",
    "v4.8.11",
    "v4.8.12",
    "v4.8.13",
    "v4.8.2",
    "v4.8.3",
    "v4.8.4",
    "v4.8.5",
    "v4.8.6",
    "v4.8.7",
    "v4.8.8",
    "v4.8.9",
    "v4.9.0",
    "v4.9.1",
    "v4.9.2",
    "v4.9.3",
    "v4.9.4",
    "v4.9.5"
  ]
}

easycorp/easyadmin-bundle Packagist

Ecosystem versions

From 5.0.0 before 5.5.1

Fixed in 5.5.1

22 explicitly affected versions

v5.0.0, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.13, v5.0.14, v5.0.15, v5.0.2, v5.0.3, v5.0.4, v5.0.5, v5.0.6, v5.0.7, v5.0.8, v5.0.9, v5.1.0, v5.2.0, v5.3.0, v5.4.0, v5.4.1, v5.5.0